3 ms·

The QR code points to the URL of a QR code generator site (qrco.de - cool domain btw) that then redirects to the actual vaccine passport I guess. Seems that eit

by geoah 5y ago

The QR code points to the URL of a QR code generator site (qrco.de - cool domain btw) that then redirects to the actual vaccine passport I guess. Seems that either the URL was too long or the owner used their "scan tracking" feature. In either case, when eventually qrco.de gets discontinued, you end up in the best case with a 404 URL on your arm, or in the worst case someone buys it and does a catch-all redirect to random youtube (or porn) videos. Just wow. I'll keep an eye for when the domain expires I guess. --- EDIT: OH MY GOD. I scanned the QR code but didn't actually visit the URL before posting the above comment as I was amazed that someone would have used a random site's URL in their tattoo. It gets worse though. (I'm really strugling not writting the remaing post in all caps). The QR code points to https://qrco.de/bcJgE2 https://qrco.de/bcJgE2 -- which opens AN IMAGE OF A QRCODE. I don't know what to say about this any more. It's not a redirect to the original QR code. It's THE ORIGINAL QR CODE. I don't even.

dane-pgp 5y ago
Maybe they were hoping that the scanner would try to recursively scan the returned image, and trigger some sort of buffer overflow or denial-of-service. This still seems like an unnecessarily painful way to carry out such an attack though. The attack would make a little more sense if it was a response to the increasing prevalence of biometric-scanning public surveillance, but in which case the mark shouldn't be on his upper arm and instead be on his right hand or forehead. Anyway, if the domain ever does expire, I'm sure someone could write some software which does a brute force search for alternative QA codes that are unchanged when (visually?) XORed with the existing design, but which point to a domain that hasn't been registered yet. He should perhaps work out what the minimum such change needed is and register the corresponding domain now, just in case.

by geoah 5y ago

dane-pgp 5y ago

Maybe they were hoping that the scanner would try to recursively scan the returned image, and trigger some sort of buffer overflow or denial-of-service. This still seems like an unnecessarily painful way to carry out such an attack though. The attack would make a little more sense if it was a response to the increasing prevalence of biometric-scanning public surveillance, but in which case the mark shouldn't be on his upper arm and instead be on his right hand or forehead. Anyway, if the domain ever does expire, I'm sure someone could write some software which does a brute force search for alternative QA codes that are unchanged when (visually?) XORed with the existing design, but which point to a domain that hasn't been registered yet. He should perhaps work out what the minimum such change needed is and register the corresponding domain now, just in case.